[shengpuerh]

Finding vulns in popular OSS and disclosing is probably good for your reputation as a security researcher, even if it's not immediately profitable.

[Hackbraten]

How is that sustainable?

Are security researchers going to be doing free labor for you indefinitely for exposure?

[stephantul]

They sell their products using the credentials they gained.

I’d never heard of socket until they found and reported shai hulud hiding in pytorch lightning. It pays off.

[Hackbraten]

What happens after a couple of players have obtained marketshare and the market has consolidated?

I think there are diminishing returns to be had.

[hn_throwaway_99]

This is essentially Snyk's business model. Sure, they do upsells, but it seems fully sustainable to me.